phpreactjslaravelsanctum

Laravel + GatsbyJS app, using auth:sanctum to manage logging in, all other users received server 500 error but my login is fine?

So I have an app (laravel backend, GatsbyJS frontend) that I'm helping to work on. A month ago, all users were able to log in with no issues. But I found out that now, all users can't log in in production (apart from me).

login.jsx file

  const formChanged = async (e) => {
    setError(false);
    e.preventDefault();
    setSubmitting(true);
    let loginData = getValues();
    let response = await login(loginData.email, loginData.password);
    setSubmitting(false);
    if (response.error) {
      setError(true);
      setValue('password', '');
    } else {
      navigate('/app/idm/');
    }
  };

let response = await login() calls a method, login in an api.js file

api.js file

// Login to the application
export const login = async (email, password) => {

  // make request
  let response = await makeRequest('post', '/login', { email, password });

  // if not an error, set the token and user
  if (!response.error && isBrowser()) {
    localStorage.setItem('idm_token', response.data.access_token);
    let my_user = JSON.stringify(await me(response.data.access_token));
    localStorage.setItem('idm_user', my_user);
  }

  return response;
};

When we pass the email and password over, this gets validated and at this moment, ALL users generate a token with no problem.

(Just for reference, the code that generates the sanctum token) api.php file

Route::post('/login', function(Request $request) {
    $login = $request->only('email', 'password');

    if (Auth::attempt($login)) {
        $user = User::where('email', $request['email'])->firstOrFail();
        
        $token = $user->createToken('auth_token')->plainTextToken;

        return response()->json([
            'access_token' => $token,
            'token_type' => 'Bearer'
        ]);
    }

    return response()->json(["message" => "Authentication failed"], 401);
})->name('api.login');

The issue appears to be accessing the route that is current auth:sanctum protected. Again, all users create a token, but only my login details allow me to access the route. All other users receive a server 500 error.

This occurs in the api.js file when we are trying to get the my_user details:

let my_user = JSON.stringify(await me(response.data.access_token));

Another issue I'm having is that my laravel app in production stopped outputting errors a few months ago, and I can't for the life of me figure out how to fix the error logging for production (it error logs just fine in development).

Apologies for the lack of detail, still new to all this and would appreciate any tips or things to try out, even if I don't get the answer, very willing to just struggle through, learn and work my way towards getting a fix for this.

Solution

  • To troubleshoot further, I decided to look into why I wasn't getting error logs.

    I decided to set the storage folder and its contents to chmod 777

    chmod -R 777 storage/

    Adding the -R to recursively set the contents to 777

    This actually fixed my log in issue, but I noticed on reverting thing back to permission level 775, some of my users were able to log in again, but not all.

    I then thought, maybe my logs file/folder had permission issues, maybe that was why I wasn't getting error logs printed out?

    So I delved further into my laravel.log file. Turns out it was set to be read by the user only (ubuntu:ubuntu). I decided to change the group of this to www-data

    chown ubuntu:www-data laravel.log

    This worked wonders for me and I was once again able to record error logs in laravel!

    I now saw my error, which was something like:

    production.ERROR: Unable to create lockable file: /var/www/main/backend/storage/framework/cache/data/d5/........etc...etcc

    So I checked each permission under storage, and found my data folder was only set to be accessible by the user

    I added www-data as the group for the data folder:

    chown ubuntu:www-data data

    And now, my issue is resolved! (n.b. my chmod permissions are back to 775)